In brief
- Exclusive automation and significant effect matter, not the label AI.
- A formal click approval is not effective human review if it merely rubber-stamps the output.
- Affected people need understandable information and a genuinely usable review route.
- Additional rules may apply in employment, credit, access and regulated sectors.
Examine the real decision process
A technical recommendation may be decisive in practice if staff almost always accept it without review. Conversely, automation may perform substantial preparatory work while a qualified person independently assesses the material information.
- Who or what makes the final decision?
- What legal or similarly significant effects arise for the person?
- Does the reviewer have time, competence and authority to depart from the output?
- Are inputs, rules, uncertainty and relevant reasons visible?
- Does the organisation measure overrides and rubber-stamping?
Apply the three-part test to the actual workflow
The special rules in Article 21 FADP concern the result of a concrete process, not every score or AI output. The three elements must be assessed together; a product description alone cannot answer them.
- 1. A decision about an individual
- The process produces a concrete decision concerning a person. Mere analysis or preparation is not enough on its own, although an ostensibly advisory score can be decisive if the following process effectively adopts it.
- 2. Based exclusively on automated processing
- No person makes a genuine substantive assessment before the final result. A human communicating or clicking through a machine-made decision does not by itself break exclusive automation.
- 3. Legal or similarly significant effect
- The result changes legal rights or obligations, or otherwise affects the person with comparable weight — for example important conditions concerning a contract, employment, credit or access to an essential opportunity.
Information and review must be effective
Affected people should be able to recognise relevant automated processing and know where to ask for review. Human review requires access to the case, the ability to correct information and authority to change the outcome.
- Explain purpose, data categories and the system’s role in plain language.
- Provide a contact and process for questions or review.
- Consider new information and objections from the affected person.
- Document the decision and any override.
- Set timelines that make the right practically usable.
Article 21 contains two narrow exceptions
The duties to inform under Article 21 paragraph 1 and, on request, to hear the person and obtain human review under paragraph 2 do not apply in two statutory situations. The exception should be documented for the particular decision; it does not remove general transparency, accuracy, fairness or other applicable duties.
- Contract: the automated decision is directly connected with entering into or performing a contract between controller and data subject, and the data subject’s request is fully granted.
- Express consent: the data subject has expressly consented to the automated decision. A hidden clause or general acceptance is not the same as an explicit, informed choice.
- Federal bodies must additionally identify an automated individual decision as such. The human-review rule has a separate public-law exception where no prior right to be heard exists under the Administrative Procedure Act or another federal act.
Human oversight needs real decision-making ability
Automation bias can cause people to accept machine recommendations too readily. Oversight becomes stronger when the system displays limitations, exposes alternatives and stops under uncertainty.
- Step 1
Build competence
Reviewers understand the domain, system limits and common errors.
- Step 2
Show evidence
Make sources, inputs, relevant factors and uncertainty available.
- Step 3
Enable override
The reviewer can correct, reject or escalate without inappropriate pressure.
- Step 4
Measure effectiveness
Monitor errors, group differences, overrides and complaints.
Reduce risk through process design
Sometimes the strongest control is a smaller decision role rather than a better model. The system can organise information, triage cases or prepare options without making the final decision.
- Limit AI to preparation and alerts.
- Do not derive hard exclusions solely from probabilistic output.
- Verify critical factors separately against authoritative sources.
- Route unclear and exceptional cases to people.
- Plan a DPIA and discrimination assessment where risk may be high.
Example: Credit pre-screening rather than automated rejection
A system checks completeness and flags unusual information but cannot reject an application. A trained specialist sees the source data, system indicators and limits, can request additional evidence and decides independently. Rejections are explained and applicants receive a review contact. The organisation monitors errors and overrides.
What to remember
Map where the final decision occurs and what effect it has. Design human review as a real, informed decision with override authority and measurable effectiveness.
Sources and further reading
These primary sources provide further detail on definitions, technical foundations or responsible use.
Content reviewed
Reviewed 17 July 2026. General information, not legal advice. The specific legal position and applicable scope must be assessed for each use case.